Cyber Security Fundamentals Training Course

Participants can relate security policies and controls to recognised governance frameworks.

• NIST Cybersecurity Framework functions: Govern, Identify, Protect, Detect, Respond, Recover
• ISO/IEC 27001 management system concepts, scope, policy and accountability
• CIS Controls safeguards selected according to organisational risk and capability
• Policy hierarchy covering standards, procedures, baselines and technical instructions
• Control ownership, evidence retention and review cycles for assurance activities
• Security metrics distinguishing control performance, risk exposure and operational workload

Participants can identify assets, classify information and define proportionate protection requirements.

• Asset inventory fields covering owner, location, dependency, value and lifecycle
• Data classification labels based on sensitivity, legal duties and business impact
• Information handling rules for storage, transmission, printing and disposal
• Critical service mapping from business process through applications and infrastructure
• Security requirements derived from classification, service criticality and user needs
• Shadow IT discovery using procurement records, network evidence and user interviews

Participants can produce a risk assessment that links threats, weaknesses, impacts and treatments.

• Risk statements connecting asset, threat event, vulnerability and business consequence
• STRIDE threat modelling for spoofing, tampering, repudiation, disclosure, denial and escalation
• Likelihood assessment using attacker capability, exposure, control strength and history
• Impact analysis covering financial loss, service disruption, safety and legal obligations
• Risk treatment choices: avoid, reduce, transfer, accept or monitor
• Risk registers with owners, target dates, residual ratings and treatment evidence

Participants can design access controls based on identity assurance and authorised business roles.

• Identity lifecycle processes for joiners, movers, leavers and temporary workers
• Multi-factor authentication selected by system sensitivity, threat level and user context
• Role-based access control mapped to job duties and application permissions
• Least privilege and need-to-know applied to routine administrative access
• Segregation of duties preventing conflicting approval, payment and administration activities
• Privileged access management for administrator accounts, sessions and credential vaults

Participants can identify human-centred attack methods and specify practical user safeguards.

• Phishing indicators in email headers, sender domains, links and attachments
• Business email compromise controls for payment changes and executive impersonation
• Pretexting, baiting, tailgating and vishing attack methods recognised by staff
• Security awareness content targeted to high-risk roles and recurring behaviours
• Reporting channels that capture suspicious messages without discouraging early reporting
• Password manager use, passphrases and credential reuse prevention practices

Participants can select network controls that reduce exposure and limit attacker movement.

• Network segmentation separating users, servers, administration systems and sensitive services
• Firewall rule design using source, destination, port, protocol and business justification
• Zero Trust principles for verifying access requests and limiting implicit trust
• Secure remote access through VPN, multi-factor authentication and device checks
• Wireless security using WPA3, separate guest networks and managed authentication
• Network intrusion detection signatures, anomaly alerts and traffic baselining

Participants can define secure endpoint baselines and monitor compliance with them.

• Secure configuration baselines for operating systems, browsers and productivity software
• CIS Benchmarks used to remove insecure defaults and unnecessary services
• Endpoint detection and response telemetry for suspicious process and file activity
• Application allowlisting and execution controls limiting unauthorised software installation
• Disk encryption, screen locking and removable media controls for portable devices
• Mobile device management policies for enrolment, updates, wiping and compliance

Participants can prioritise vulnerabilities and establish a defensible remediation process.

• Vulnerability management lifecycle from discovery through validation and closure evidence
• CVSS scores interpreted alongside exploitability, asset criticality and external exposure
• Known Exploited Vulnerabilities catalogues used for urgent remediation decisions
• Patch deployment rings balancing rapid protection, testing needs and service stability
• Compensating controls documented when patches cannot be applied promptly
• Configuration drift detected against approved builds and security baselines

Participants can recognise common attack techniques and select controls against ransomware scenarios.

• Malware categories including ransomware, trojans, worms, spyware and rootkits
• MITRE ATT&CK tactics linking attacker objectives to observable technical behaviours
• Initial access routes through phishing, exposed services, stolen credentials and suppliers
• Lateral movement controls using segmentation, privileged access restrictions and monitoring
• Ransomware containment priorities for affected hosts, accounts, shares and backups
• Indicators of compromise assessed through endpoint, network, identity and email evidence

Participants can specify appropriate encryption and key management controls for sensitive data.

• Encryption at rest protecting databases, devices, backups and removable media
• TLS certificates securing data in transit between browsers, services and APIs
• Hashing, salting and password storage distinguished from reversible encryption
• Public key cryptography supporting certificates, digital signatures and secure exchange
• Key management lifecycle covering generation, storage, rotation, revocation and destruction
• Data loss prevention rules detecting unauthorised movement of classified information

Participants can identify application security requirements and common software weaknesses.

• Secure development lifecycle activities from requirements through release and maintenance
• OWASP Top 10 risks including injection, broken access control and insecure design
• Input validation, output encoding and parameterised queries preventing common injection flaws
• Code review and dependency scanning identifying defects before production deployment
• Security testing methods: static analysis, dynamic testing and penetration testing
• API security controls for authentication, authorisation, rate limiting and logging

Participants can assess cloud service risks and assign controls between customer and provider.

• IaaS, PaaS and SaaS responsibilities divided between customer and provider
• Cloud identity controls using federated access, roles and conditional policies
• Misconfiguration risks involving public storage, open ports and excessive permissions
• Cloud logging sources for administrative actions, data access and configuration changes
• Encryption and key ownership decisions for cloud-hosted sensitive information
• Cloud security posture management findings prioritised by exposure and business impact

Participants can define useful logging requirements and triage security alerts consistently.

• Logging requirements for authentication, privilege changes, transactions and configuration events
• SIEM correlation rules combining endpoint, identity, network and cloud signals
• Alert triage based on severity, confidence, scope, asset value and urgency
• False positive reduction through tuning, contextual enrichment and documented thresholds
• Log retention periods aligned with investigation needs, regulation and storage capacity
• Time synchronisation using NTP to preserve reliable incident timelines

Participants can coordinate an initial incident response and preserve relevant evidence.

• Incident classification using impact, urgency, affected scope and regulatory reporting criteria
• Response playbooks defining roles, escalation paths, decisions and communication channels
• Containment actions selected to limit harm while preserving critical business services
• Digital evidence handling with chain-of-custody records and integrity protection
• Forensic artefacts including logs, memory, disk images, emails and authentication records
• Post-incident reviews producing root causes, corrective actions and accountable owners

Participants can align recovery controls with business service priorities and recovery objectives.

• Business impact analysis identifies critical services, dependencies and maximum downtime
• Recovery time objective and recovery point objective set for services
• Backup strategies using 3-2-1 copies, immutability and offline protection
• Disaster recovery runbooks covering failover, restoration, verification and communications
• Recovery testing methods: walkthrough, simulation, technical test and parallel operation
• Ransomware recovery decisions prioritising clean restoration and evidence preservation

Participants can assess supplier security exposure and define proportionate assurance measures.

• Supplier due diligence examining security controls, certifications, incidents and subcontractors
• Contract clauses covering data handling, breach notification, audit rights and exit
• Third-party access controls using named accounts, time limits and activity monitoring
• Supply chain threats from compromised software updates, components and service providers
• Physical security layers covering sites, visitor controls, equipment and secure disposal
• Third-party risk registers linked to service criticality, data access and dependencies

Participants can connect technical security controls with privacy duties and assurance evidence.

• Privacy principles of purpose limitation, minimisation, accuracy and retention control
• Personal data breach assessment based on affected individuals and likely harm
• Control testing through evidence sampling, interviews, observation and technical inspection
• Internal audit findings written with condition, criterion, cause, effect and action
• Security exceptions approved with risk acceptance, expiry dates and compensating controls
• Assurance reporting distinguishes design effectiveness from operating effectiveness evidence

Participants can turn assessment findings into a prioritised security improvement roadmap.

• Security architecture principles connecting business needs, risk appetite and control design
• Target-state diagrams showing trust boundaries, data flows and protective controls
• Control gaps prioritised through risk reduction, cost, dependency and implementation effort
• Security roadmap sequencing quick wins, foundational controls and long-term initiatives
• RACI matrices assigning accountable owners, contributors, approvers and informed parties
• Board-ready reporting using risk trends, decisions required and measurable outcomes

Participants can build, review and present a complete security assessment and improvement plan for a defined system or service.

• Scope a selected service, assets, users, dependencies and information classifications
• Document threat scenarios using STRIDE, attack paths and business consequences
• Assess existing controls against NIST functions, CIS Controls and stated requirements
• Prioritise risk treatments using residual risk, feasibility, ownership and target dates
• Prepare incident, recovery and supplier actions supporting the proposed treatment plan
• Present the security improvement pack for peer review and management decisions